Hello Lixin,
Since you can't reduce the number of sources, you should limit the number of
processing done on each source, meaning this:
-let's say that your profiles monitor traffic for networks A-Z (each profile
monitors each network). You should split the processing on two or more
servers, meaning that you export the same flows (from the 5 sources) to each
server, but you process different profiles/channels on each server. For
instance, server 1 could process traffic for networks A-K, server 2 could
process for networks L-O, server 3 for networks P-Z.
Even if the same amount of netflow data reaches your servers, you will be
interested only in part of that data on each server. This way you can build
profiles that use data from different sources on the same server.
Unfortunatelly, there is no easy way to integrate multiple nfsen views under
the same page, but you could build a simple html page with descriptions and
links to each nfsen instance if you divide your processing according to
relevant categories (e.g. one nfsen instance could process your business
customers, another one could process your residential customers, etc.).
Good luck!
On Tue, Apr 15, 2008 at 5:45 AM, Lixin Zou <[EMAIL PROTECTED]> wrote:
> hi Adrian,
> Thanks for your reply,and could you give me some further suggestions about
> distributing the procssing? Now, I have five netflow source, and my several
> handred continue/shadow profiles were built from these five netflow source.
> If I move some profiles to the second server, then how to access the first
> server's netflow data? Does the nfsen support NFS file system?
> further question: if i want to build one profile which need two netflow
> source,but these two netflow source were distributed on two different
> server. In the nfsen's config file(nfsen.conf), I can't find any info or
> variables about host or server.
>
> Thanks,
> Lixin
>
> 2008/4/14, Adrian Popa <[EMAIL PROTECTED]>:
>
> > Hello,
> >
> > As you saw for yourself, the server can't update all the profiles
> > because the amount of data it needs to process goes over the 5 minute limit:
> >
> > Apr 14 15:00:43 xtunnel nfsen[38427]: Behind schedule
> >
> > You should remove some channels/profiles until the ones you have are
> > graphed ok... Distribute the processing on multiple servers.
> > Also, look at the load on that server (with the top or uptime command).
> > If the load number is greated than your processor number, than the system is
> > overloaded (this is an estimation)...
> >
> > Good luck!
> > Adrian
> >
> > On Mon, Apr 14, 2008 at 1:53 PM, Lixin Zou <[EMAIL PROTECTED]> wrote:
> >
> > > Hi all,
> > >
> > > I'm having some troubles when making my own profiles. Our website has
> > > more than ten channels and these channels were divided into serval
> > > sub-channel.We want to monitor every channel and every sub-channel and
> > > even
> > > some sub sub channels or some IP. So, I have to create several handred
> > > continue/shadow profiles for these channels.Now I have created the
> > > profiles
> > > by using some shell scripts.I can get the target profiles except the
> > > profiles picture is not continuous.What i mean is,the profiles' rrd
> > > picture
> > > is just like a kind of fence.For example,from 10 to 30 minute,we can see
> > > netflow traffic from the profile's rrd picture,then we can't see the
> > > netflow
> > > traffic in the picture from 30 to 45 minute, but in fact, I can grep the
> > > profile's IP from the appropriate nfcapd file during 30 to 45 minute.I set
> > > the debug mode and get these message as follows:
> > >
> > > Apr 14 14:38:33 xtunnel nfsen[38427]: Behind schedule
> > > Apr 14 14:47:19 xtunnel nfsen[38427]: Channel info file missing for
> > > channel 'xidan_vpn' in './live'
> > > Apr 14 14:47:19 xtunnel nfsen[38427]: Channel info file missing for
> > > channel 'xidan_zx' in './live'
> > > Apr 14 14:49:41 xtunnel nfsen[38427]: Behind schedule
> > > Apr 14 14:57:57 xtunnel nfsen[38427]: Channel info file missing for
> > > channel 'xidan_vpn' in './live'
> > > Apr 14 14:57:57 xtunnel nfsen[38427]: Channel info file missing for
> > > channel 'xidan_zx' in './live'
> > > Apr 14 15:00:43 xtunnel nfsen[38427]: Behind schedule
> > > Apr 14 15:08:55 xtunnel nfsen[38427]: Channel info file missing for
> > > channel 'xidan_vpn' in './live'
> > > Apr 14 15:08:55 xtunnel nfsen[38427]: Channel info file missing for
> > > channel 'xidan_zx' in './live'
> > > Apr 14 15:11:40 xtunnel nfsen[38427]: Behind schedule
> > > and also I got the info like:
> > > Apr 14 18:41:50 xtunnel nfsen[19514]: comm child[19515] terminated
> > > with no exit value
> > > Apr 14 18:41:50 xtunnel nfsen[19514]: Cmd Decode: get-profile
> > > Apr 14 18:41:50 xtunnel nfsen[19514]: Cmd Decode: quit
> > > Apr 14 18:41:50 xtunnel nfsen[18204]: comm child[19514] terminated
> > > with no exit value
> > > Apr 14 18:41:51 xtunnel nfsen[18204]: connection on UNIX socket
> > > Apr 14 18:41:51 xtunnel nfsen[18204]: comm server started: 19516
> > > Apr 14 18:41:51 xtunnel nfsen[19516]: Cmd Decode: get-detailsgraph
> > > Apr 14 18:41:51 xtunnel nfsen[18204]: comm child[19516] terminated
> > > with no exit value
> > > Apr 14 18:41:51 xtunnel nfsen[18204]: connection on UNIX socket
> > > Apr 14 18:41:51 xtunnel nfsen[18204]: comm server started: 19517
> > > Apr 14 18:41:51 xtunnel nfsen[19517]: Cmd Decode: get-detailsgraph
> > >
> > > I think, the problem is that nfprofile have to mantain every created
> > > profile.If the number of profiles is large,then the maintain time will be
> > > long and sometimes cause nfsen not to draw the picture.Am i right? but I
> > > don't know how to solve it,pls help me.
> > >
> > > My second question is: I have setup serveral nfsen on different
> > > servers and i would like to build a single html page including all these
> > > profiles to display the pngs and the netflow procesing results. I have
> > > searched the nfsen-discuss and known other people also have such
> > > problem.but
> > > I also want to know how to display other servers' netflow procssing
> > > section,and this section is very important for us,because it can help us
> > > to
> > > identify which ip's traffic is large.Does nfsen can do that?
> > >
> > > Thanks,
> > > Lixin
> > >
> > > -------------------------------------------------------------------------
> > > This SF.net email is sponsored by the 2008 JavaOne(SM) Conference
> > > Don't miss this year's exciting event. There's still time to save
> > > $100.
> > > Use priority code J8TL2D2.
> > >
> > > http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone
> > > _______________________________________________
> > > Nfsen-discuss mailing list
> > > [email protected]
> > > https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
> > >
> > >
> >
>
> -------------------------------------------------------------------------
> This SF.net email is sponsored by the 2008 JavaOne(SM) Conference
> Don't miss this year's exciting event. There's still time to save $100.
> Use priority code J8TL2D2.
>
> http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone
> _______________________________________________
> Nfsen-discuss mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
>
>
-------------------------------------------------------------------------
This SF.net email is sponsored by the 2008 JavaOne(SM) Conference
Don't miss this year's exciting event. There's still time to save $100.
Use priority code J8TL2D2.
http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone
_______________________________________________
Nfsen-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
